Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1999 to the following vulnerability: Apple Safari 3.1.1 allows remote attackers to spoof the address bar by placing many "invisible" characters in the userinfo subcomponent of the authority component of the URL (aka the user field), as demonstrated by %E3%80%80 sequences. Refences: http://www.securityfocus.com/archive/1/archive/1/491192/100/0/threaded http://es.geocities.com/jplopezy/pruebasafari3.html http://www.frsirt.com/english/advisories/2008/1347 http://secunia.com/advisories/29900 http://xforce.iss.net/xforce/xfdb/41981
Even though this CVE is worded as affecting Apple Safari, this issue is probably in WebKit. Test case causes both kazehakase(-webkit) and midori to display spoofed URL as: attacker_controlled_prefix<spaces ... spaces>@real_url Depending on the with of your browser window, you may only see attacker_controlled_prefix part of the URL, which may trick you to believe you are currently visiting different site. If you switch kazehakase to use gecko, it will: - warn you that you are trying to log to a site that does not require authentication - display %-encoded sequence in address bar (same behavior as you get with e.g. firefox) I haven't checked WebKit SVN whether there is any fix for this already. Tested with: WebKit-gtk-1.0.0-0.8.svn32416
r32901 seems no good (however would you check it?) http://koji.fedoraproject.org/koji/taskinfo?taskID=597635
Yes, r32901 / WebKit-1.0.0-0.9.svn32901 still affected.
No change with WebKit-1.0.0-0.10.svn34655
The geocities page with the proof of concept is gone. I can't find any reference that this was fixed, but considering how old this is and that we currently have webkitgtk 1.2.x, I imagine this is fixed, but can't verify. Does someone have a local copy of this PoC? I also can't find anything in the upstream webkit bts so no idea if this has been addressed or not.
There is nothing webkit can do in here. URL handling is handled by the browser layer.